TechKnowSurge
Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.6 Cisco CyberOps Associate 4.8 Cisco CyberOps Associate 4.7
TechKnowSurge Catalog Videos Navigating Wireshark
VideoNetworkFree

Navigating Wireshark

Wireshark's interface is organized into a packet list, packet details, and packet bytes pane, each providing a different layer of visibility into captured network traffic. Understanding the layout is the foundation for effective packet analysis.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark organizes its workspace into a menu bar, a quick-access toolbar, a display filter bar, three main analysis panes, and a status bar at the bottom. The menu bar covers standard file, edit, and view operations familiar from most desktop applications, while the toolbar surfaces the most frequently used capture and analysis controls for faster access. The display filter bar accepts filter expressions that narrow the packet list to only the traffic relevant to a given investigation, a capability covered in depth elsewhere. The three main panes form the core of the analysis workflow and can each be resized to suit the task at hand. The top pane, the packet list, presents every captured frame in chronological order and columns showing the packet number, a relative timestamp starting at zero, source and destination IP addresses, protocol, packet length, and a brief info summary. Selecting any row in this pane immediately populates the two panes below it. The middle pane, the packet details view, breaks the selected frame down layer by layer, from the physical frame and Ethernet header through the Internet Protocol and transport-layer fields such as TCP, all the way up to application-layer protocols like HTTP. Expanding the HTTP node, for example, reveals the full request method, URI, headers, and other fields. The bottom pane displays the raw hexadecimal and ASCII representation of the packet, and selecting any field in the details pane highlights the corresponding bytes, making it straightforward to see exactly which bits on the wire correspond to a given protocol field. This layered, synchronized view allows analysts to move fluidly between a high-level traffic overview and deep protocol inspection.

What you'll learn

What's covered

Wireshark Interface Overview

Aligned to

Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.6 Extract files from a TCP stream when given a PCAP file and Wireshark
4.8 Interpret the fields in protocol headers as related to intrusion analysis
4.7 Identify key elements in an intrusion from a given PCAP file

Key terms

Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Protocol
A set of rules governing the format and transmission of data between devices.
Transmission Control Protocol
TCP
A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Internet Protocol
IP
The principal communications protocol for routing packets across network boundaries.
Hypertext Transfer Protocol
HTTP
An application-layer protocol that defines how web browsers and servers communicate to request and deliver web pages and other content, operating over TCP on port 80. HTTP transmits data in plaintext, which is why it has been largely replaced by HTTPS for sensitive content.
Packet List Pane
The top section of the Wireshark interface that displays a scrollable summary of all captured packets, including packet number, timestamp, source, destination, protocol, and length.
Packet Details Pane
The middle section of the Wireshark interface that displays the decoded protocol layers and field-level information for a selected packet.
Packet Bytes Pane
The bottom-right section of the Wireshark interface that displays the raw binary and ASCII representation of the selected packet's data.

Topics

Wireshark Packet Analysis Network Traffic Protocol Analysis Http Networking

Transcript

The general layout

Up here at the top I can just see our menu items, and there's a lot of different menu items that I can go through, but a lot of them are just standard menu items, things like the standard Edit and View and File that we see on a lot of different programs, so I'm not going to get too in depth into that.

Next is some quick launches here, just some buttons where I can have some quick access to some of the more commonly used features. So I've got this bar that I can use.

Next here I've got the filter. If I want to do any kind of filtering for my packets I can do it in here, and we'll take a look at that separately.

Then I've got down here at the bottom just some statistics, and that's pretty common to most programs as well.

The main section

We've got the main section in here, and it's broken into three parts, and this is where I'm going to spend most of the time. First of all, I can grow and shrink each one of these windows depending on what it is that I'm trying to look at and analyze.

The first one up here at the top: as we scroll through here we can see all of the data that we captured. We can see some spanning tree messages that come across here. We can see here some communication. This is 10110 do34, so that's this machine, and it's sending out what looks like some sort of multicast there. Then we've got some IP version 6 stuff going on in here as well, so we can see some different data.

At one point in time I opened up a web page, and you can go through and see all the back and forth with these packets that are happening from my IP address of this machine to that web server, and then back from the web server to this machine. So as I go through here I can select these different packets, and notice that as I'm selecting the different packets, down here on the bottom it's showing me what information is in each one of those packets. Now I can analyze what happened between this machine and this other machine here, so I can see 39 through 48. Then as I scroll through here I see some more TCP connections.

So what is some of the information that I see here? I can see the packet number: 39, 40, 41, 42, 43, 44, 45, 46, 47, 48. Those are the different packet numbers. I can see the time stamp on it, and this is relative, so it starts out at zero and then it just counts up from there. Here at probably the 21 second mark to 22 second mark was when I opened up this browser. I can see what the source and destination IP address is, what protocol it's using, the length of those, and then some details that are associated with that. So that is the main window, a lot of great information in this section.

Drilling into a packet

Say I'm most interested in studying HTTP and what HTTP looks like. So let's click on this first HTTP, and it's a get, so it's making a request here. Then down here I can see what's inside of the frame. I open this up and see what's happening from the frame level. I can take a look at the ethernet level and look at what MAC address it's being sent to, and then I can close that. I can also look at the Internet Protocol version 4, so I see the information in there, and then the Transmission Control Protocol.

But as I mentioned, I really am most interested in the hypertext transfer protocol, the HTTP. So I open this up and then I can see what this HTTP request looks like and the details of it, to include the URI, and that's the URI that I typed in, and then any information that I want to look into further.

If I select any of this, it's going to highlight it over here on the right hand side. These are the bits, these are actual bits flowing. And then this is showing me the data that is what those bits are forming, so this gives me an idea of what the data is actually saying. This is the actual data over here.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →